490544 - corp01.sj.mozilla.com is on a spam blacklist

Status: RESOLVED FIXED

(mozilla.org Graveyard :: Server Operations, task)

Description

[Boris Zbarsky [:bzbarsky]]

jst tried sending me e-mail today, and it got bounced by MIT's mail server with:

     Host M24-004-BARRACUDA-1.mit.edu[18.7.7.111] said: 554
     Service unavailable; Client host [corp01.sj.mozilla.com] blocked using
     Barracuda Reputation;
     http://bbl.barracudacentral.com/q.cgi?ip=63.245.208.141 (in reply to RCPT
     TO command)

I went to that url and put in a request to remove from the blacklist, but I couldn't give a reason past "I don't think it should be on the list" and I have no idea whether the box is in fact doing anything weird...  Might be good to put in a request with contact info for someone who might actually know what's going on.

Comment 1

[Dave Miller [:justdave]]

We would need a copy of an example email that triggered the listing in order to track it.  Where was he when he sent that email?  None of our mail servers use that IP.  In fact, I'd consider that listing legitimate, as nothing sending email from our infrastructure should be sending it from that IP.

Comment 2

[Dave Miller [:justdave]]

Hmm, take that back, apparently that's the outbound address used by the Zimbra server.  Must have sent it via the web interface or something, since the published smtp server for people to use isn't actually zimbra.

Comment 3

[Reed Loden [:reed]]

Looking into it.

Comment 4

[Reed Loden [:reed]]

Request Received

Thank you for submitting your request. If this is your first request, your IP address will have its reputation increased to "normal" for 48 hours while we investigate. It may take up to 1 hour for the reputation increase to propagate to all Barracuda Spam Firewalls globally. We appreciate your patience and apologize for any inconvenience.

Your confirmation number is BBR21240954332-09116-8258.

Comment 5

[Boris Zbarsky [:bzbarsky]]

Yes, the mail in question was sent via zimbra's web interface; sorry for not mentioning that.

Beltzner was just saying that he'd been running into the same issue as well when sending me mail (as well as when sending mail to all@, of course; he got a bounce when that tried to get delivered to me).  He was also sending through zimbra, unsurprisingly.

Comment 6

[Boris Zbarsky [:bzbarsky]]

This worked for a few days, but apparently is broken again today.

Comment 8

[Boris Zbarsky [:bzbarsky]]

For what it's worth, MIT added *.mozilla.com to a whitelist on their end.  The problem probably remains with other Barracuda installs.

Comment 9

[K Lars Lohn [:lars] [:klohn]]

I contacted the ISP of the WebDev contractor to whom I've been unable to send email today.  They've put us on their local white list.  I seem to be able to get messages through now, well, at least I'm not getting them bounced back...

Comment 10

[Reed Loden [:reed]]

Ok, I finally got in touch with somebody at Barracuda Networks, and it turns out it's really all bz's fault. ;)

Basically, what's happening is that spam is coming into your @mozilla.com account, not getting spam checked because you opted out of postini, being forwarded to your @mit.edu account, MIT's spam filters are detecting messages as (valid) spam, and Zimbra's IP gets added to a blacklist for sending spam, even though it's just forwarding it.

For now, you (bz) have been added back to postini. We're going to work on policy concerning outside forwarding and spam filtering soon that will help stop this from happening in the future.

All six blacklisted IPs have been removed from the BRBL, so I'm resolving this as fixed.

Comment 11

[Boris Zbarsky [:bzbarsky]]

I see.  That's very interesting; I wonder whether it would be possible to set up postini to just block forwarding of the mail it considers spam, not drop it on the floor entirely...

Comment 12

[Reed Loden [:reed]]

(In reply to comment #11)
> I see.  That's very interesting; I wonder whether it would be possible to set
> up postini to just block forwarding of the mail it considers spam, not drop it
> on the floor entirely...

What do you mean? Spam that postini catches goes into a quarantine that you can access at https://intranet.mozilla.org/postini/. It's not just sent to /dev/null.

Comment 13

[Boris Zbarsky [:bzbarsky]]

I seem to recall having a problem with stuff disappearing from there if I didn't look at it soon enough...  but maybe I was just mistaken.

Comment 14

[Dave Miller [:justdave]]

yeah, it only keeps it for 3 days I think

Comment 15

[Reed Loden [:reed]]

(In reply to comment #14)
> yeah, it only keeps it for 3 days I think

I have mail in my quarantine back to 4/29/09, so it's longer than that.